Qian Chen

**Name of the Vulnerable Software and Affected Versions** Amazon Alexa software version 8960323972 **Description** The issue allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz, which is often outside the range of human adult hearing. Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful. **Recommendations** For Amazon Alexa software version 8960323972, consider disabling the ability to receive commands via audio signals until a patch is available. Restrict access to the device to minimize the risk of exploitation. Avoid using the device for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Webex Room Phone (affected versions not specified) Cisco Webex Share (affected versions not specified) **Description** A vulnerability in the Link Layer Discovery Protocol (LLDP) feature could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This issue is due to insufficient resource allocation and errors in memory deallocation. An attacker could exploit this by sending crafted LLDP traffic to an affected device, potentially exhausting the memory resources and causing the LLDP process to crash. If the device is configured to support LLDP only, this could interrupt inbound and outbound calling. By default, these devices support both Cisco Discovery Protocol and LLDP. **Recommendations** For Cisco Webex Room Phone, to resolve the issue, a manual restart of the device is required to recover its operational state after a successful exploit. For Cisco Webex Share, as a temporary workaround, consider disabling the LLDP feature until a fix is available. Restrict access to the LLDP protocol to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenvSwitch (affected versions not specified) **Description** The issue is related to an out-of-bounds read in Organization Specific TLV found in OpenvSwitch. It can be exploited by sending specially crafted LLDP messages to the vulnerable system, potentially allowing remote attackers to execute arbitrary code. The vulnerability is also associated with an integer overflow when parsing Auto Attach TLV. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open vSwitch versions prior to the fixed version **Description** The issue is related to an integer underflow in Organization Specific TLV, which can be exploited by sending specially crafted LLDP messages to the vulnerable system, allowing a remote attacker to execute arbitrary code. **Recommendations** For versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the Organization Specific TLV to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cisco IP Phone 7800 and 8800 Series firmware versions prior to 14.2 **Description** A vulnerability in the Cisco Discovery Protocol processing feature could allow an unauthenticated, adjacent attacker to cause a stack overflow on an affected device. This is due to insufficient input validation of received Cisco Discovery Protocol packets. An attacker could exploit this by sending crafted Cisco Discovery Protocol traffic to an affected device, potentially allowing remote code execution or a denial of service (DoS) condition. The vulnerability is caused by insufficient validation of `received Cisco Discovery Protocol packets`. **Recommendations** For Cisco IP Phone 7800 and 8800 Series firmware versions prior to 14.2, consider disabling the Cisco Discovery Protocol on affected IP phones as a temporary workaround, especially since these devices also support the Link Layer Discovery Protocol (LLDP). However, before deploying any workarounds or mitigation measures, evaluate their applicability to your environment and potential impact. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Synology Presto File Server versions prior to 2.1.2-1601 **Description** The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal', in file operation management. This allows remote attackers to write arbitrary files via unspecified vectors. **Recommendations** For versions prior to 2.1.2-1601, update to version 2.1.2-1601 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Synology Presto File Server versions prior to 2.1.2-1601 **Description** The issue is related to improper privilege management in the summary report management of Synology Presto File Server. This allows remote authenticated users to bypass security constraints. **Recommendations** For versions prior to 2.1.2-1601, update to version 2.1.2-1601 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Synology DiskStation Manager (DSM) versions prior to 7.1-42661 **Description** A Server-Side Request Forgery (SSRF) issue in the Package Center functionality allows remote authenticated users to access intranet resources via unspecified vectors. This could potentially lead to unauthorized access to internal resources. **Recommendations** For versions prior to 7.1-42661, update to version 7.1-42661 or later to resolve the issue. As a temporary workaround, consider restricting access to the Package Center functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Synology DiskStation Manager (DSM) versions prior to 7.1-42661 **Description** The issue concerns a missing authentication mechanism for a critical function in the iSCSI management functionality. This allows remote attackers to read or write arbitrary files via unspecified vectors. **Recommendations** For versions prior to 7.1-42661, update to version 7.1-42661 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Cisco ATA 190 Series Analog Telephone Adapter (affected versions not specified) **Description** The issue is related to the implementation of the Cisco Discovery Protocol in the firmware of Cisco Analog Telephone Adapter (ATA) series 190 devices. It is caused by a lack of input data validation, which could allow a remote attacker to impact the integrity of protected information. The vulnerability is due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit this by sending a malicious Cisco Discovery Protocol packet to an affected device, potentially causing an out-of-bounds read of valid packet data and leading to corruption in the internal Cisco Discovery Protocol database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco ATA 190 Series Adaptive Telephone Adapter firmware (affected versions not specified) **Description** A vulnerability in the Cisco Discovery Protocol functionality could allow an unauthenticated, remote attacker to cause a Denial of Service (DoS) condition on an affected device. This issue is due to an out-of-bounds read when processing Cisco Discovery Protocol packets. An attacker could exploit this by sending crafted packets to an affected device, potentially causing a service restart. **Recommendations** For the Cisco ATA 190 Series Adaptive Telephone Adapter firmware, update to the latest firmware version released by Cisco that addresses this issue. As a temporary workaround, consider restricting access to the Cisco Discovery Protocol functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Cisco ATA 190 Series Adaptive Telephone Adapter (affected versions not specified) **Description** The issue exists due to insufficient input validation in the Cisco Discovery Protocol implementation of the Cisco Analog Telephone Adapter (ATA) series 190 firmware. This could allow a remote attacker to cause a denial of service. The vulnerability is caused by missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit this by sending crafted Cisco Discovery Protocol packets to an affected device, potentially causing the device to exhaust available memory and restart the service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco ATA 190 Series Analog Telephone Adapter (affected versions not specified) **Description** A vulnerability in the Cisco Discovery Protocol functionality could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause the Cisco Discovery Protocol service to restart. This issue is due to missing length validation of certain Cisco Discovery Protocol packet header fields. An attacker could exploit this by sending a malicious Cisco Discovery Protocol packet to an affected device, potentially allowing the attacker to execute code and cause the service to restart unexpectedly, resulting in a denial of service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco ATA 190 Series Analog Telephone Adapter (affected versions not specified) **Description** The issue is related to the Link Layer Discovery Protocol (LLDP) functionality and Cisco Discovery Protocol implementation in the firmware of Cisco Analog Telephone Adapter (ATA) series 190 devices. It is caused by missing length validation of certain LLDP packet header fields and a buffer overflow read in memory. An unauthenticated, remote attacker could exploit this by sending a malicious LLDP packet to an affected device, potentially allowing the execution of arbitrary code on the device and causing the LLDP service to restart unexpectedly. This could result in a denial of service (DoS) condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco ATA 190 Series Analog Telephone Adapter (affected versions not specified) **Description** The issue is related to the implementation of the Link Layer Discovery Protocol (LLDP) functionality in the firmware of Cisco Analog Telephone Adapter (ATA) series 190 devices. It is caused by missing length validation of certain LLDP packet header fields. An attacker could exploit this by sending a malicious LLDP packet to an affected device, potentially allowing them to execute arbitrary code on the device and cause the LLDP service to restart, resulting in a denial of service (DoS) condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco ATA 190 Series Analog Telephone Adapter (affected versions not specified) **Description** The issue is related to the implementation of the Cisco Discovery Protocol in the firmware of Cisco Analog Telephone Adapter (ATA) devices, series 190. It is caused by a lack of input data validation, which could allow a remote attacker to cause memory corruption and impact the integrity of protected information. The vulnerability is due to missing length validation checks when processing Cisco Discovery Protocol messages. An attacker could exploit this by sending a malicious Cisco Discovery Protocol packet to an affected device, potentially causing an out-of-bounds read of valid packet data and corruption in the device's internal Cisco Discovery Protocol database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco IOS XR Software (affected versions not specified) **Description** A vulnerability in the Cisco Discovery Protocol implementation could allow an unauthenticated, adjacent attacker to cause the Cisco Discovery Protocol process to reload on an affected device. This issue is due to a heap buffer overflow in certain Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device, potentially causing a heap overflow and leading to the reload of the Cisco Discovery Protocol process. The bytes that can be written in the buffer overflow are restricted, limiting remote code execution. Note that Cisco Discovery Protocol is a Layer 2 protocol, and to exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Synology SSO Server versions prior to 2.2.3-0331 **Description** The issue is related to a Path Traversal vulnerability in the webapi component, allowing remote authenticated users to read arbitrary files via unspecified vectors. **Recommendations** For versions prior to 2.2.3-0331, update to version 2.2.3-0331 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Synology Calendar versions prior to 2.3.4-0631 **Description** The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in the webapi component. This allows remote authenticated users to download arbitrary files via unspecified vectors. **Recommendations** For versions prior to 2.3.4-0631, update to version 2.3.4-0631 or later to resolve the issue. As a temporary workaround, consider restricting access to the webapi component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Synology Storage Analyzer versions prior to 2.1.0-0390 **Description** The issue is related to a Path Traversal vulnerability in the webapi component, allowing remote authenticated users to delete arbitrary files via unspecified vectors. **Recommendations** For versions prior to 2.1.0-0390, update to version 2.1.0-0390 or later to resolve the issue.